{"id":"CVE-2021-34762","aliases":["EUVD-2021-21412","GHSA-8m4x-wmgm-h3w9"],"status":"published","title":"Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability","description":"A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01987,"percentile":0.80783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-26"],"published":"2021-10-27T18:55:36Z","modified":"2026-08-11T21:32:53Z","products":[{"vendor":"cisco","product":"cisco firepower management center"},{"vendor":"cisco","product":"firepower_management_center_virtual_appliance"},{"vendor":"cisco","product":"secure_firewall_threat_defense"},{"vendor":"cisco","product":"sourcefire_defense_center"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-dir-traversal-95UyW5tk","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34762"},{"url":"https://github.com/advisories/GHSA-8m4x-wmgm-h3w9"}],"sources":{"cve":[{"id":"CVE-2021-34762","title":"Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability","description":"A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.","status":"published","published":"2021-10-27T18:55:36.199Z","modified":"2024-11-07T21:44:23.088Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-26"],"updated_at":"2026-11-02T14:33:11.244759Z"}],"euvd":[{"id":"EUVD-2021-21412","description":"A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.","status":"published","published":"2021-10-27T18:55:36Z","modified":"2024-11-07T21:44:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:05:07.826667Z"}],"ghsa":[{"id":"GHSA-8m4x-wmgm-h3w9","title":"A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC)...","description":"A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.","status":"published","published":"2022-05-24T19:18:55Z","modified":"2026-08-11T21:32:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-26"],"updated_at":"2026-11-02T15:10:21.509652Z"}],"nvd":[{"id":"CVE-2021-34762","description":"A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.","status":"published","published":"2021-10-27T19:15:08.06Z","modified":"2026-08-11T19:37:30.88Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-26","CWE-22"],"updated_at":"2026-11-02T14:07:00.549994Z"}]}}